Dzahn has submitted this change and it was merged.
Change subject: contint: move zuul_merger_hosts to hiera, use in ferm
......................................................................
contint: move zuul_merger_hosts to hiera, use in ferm
Remove the zuul merger host names from network.pp.
Instead, add them to hiera, for prod and for labs.
Then use a hiera lookup with a ferm::service to open firewall holes for
them to connect to 4730/tcp.
Removed lanthanum.eqiad.wmnet since it does not run a zuul-merger
process.
Bug:T87519
Change-Id: I5b88b7bc33c9f1f57ac42a2e07ff51e404b0caad
---
M hieradata/common/contint.yaml
M hieradata/labs/integration/common.yaml
M manifests/network.pp
M modules/contint/manifests/firewall.pp
4 files changed, 21 insertions(+), 14 deletions(-)
Approvals:
jenkins-bot: Verified
Dzahn: Looks good to me, approved
diff --git a/hieradata/common/contint.yaml b/hieradata/common/contint.yaml
index b924973..b15701d 100644
--- a/hieradata/common/contint.yaml
+++ b/hieradata/common/contint.yaml
@@ -3,3 +3,12 @@
# Use ip address since the value is injected in an iptables rule and ferm
# @resolve has undefined behavior.
nodepool_host: '10.64.20.18' # labnodepool1001.eqiad.wmnet
+
+# Hosts running zuul-merger process
+#
+# Use ip addresses since the values are injected in iptables rules.
+#
+zuul_merger_hosts:
+ - 208.80.154.135 # gallium.wikimedia.org
+ - '::1' # Uses quotes for hiera
+ - 127.0.0.1
diff --git a/hieradata/labs/integration/common.yaml
b/hieradata/labs/integration/common.yaml
index 87af200..2d68cfe 100644
--- a/hieradata/labs/integration/common.yaml
+++ b/hieradata/labs/integration/common.yaml
@@ -1,5 +1,10 @@
----
# T100509 Java7 on gallium does not support the hardned sshd MAC and KEX setup
# causing slaves to be unreacheable.
ssh::server::disable_nist_kex: false
ssh::server::explicit_macs: false
+# Hosts running zuul-merger process
+# Use ip addresses since the values are injected in iptables rules.
+#
+contint::zuul_merger_hosts:
+ - '::1' # uses quotes for hiera
+ - 127.0.0.1
diff --git a/manifests/network.pp b/manifests/network.pp
index cd38a8c..f14faa6 100644
--- a/manifests/network.pp
+++ b/manifests/network.pp
@@ -300,16 +300,6 @@
$mw_appserver_networks,
$analytics_networks,
]
-
- $contint_zuul_merger_hosts = {
- 'production' => [
- '208.80.154.135', # gallium.wikimedia.org
- ],
- 'labs' => [
- '127.0.0.1',
- ],
- }
-
}
class network::checks {
diff --git a/modules/contint/manifests/firewall.pp
b/modules/contint/manifests/firewall.pp
index baa7b9f..e067908 100644
--- a/modules/contint/manifests/firewall.pp
+++ b/modules/contint/manifests/firewall.pp
@@ -19,9 +19,12 @@
# Gearman is used between Zuul and the Jenkin master, both on the same
# server and communicating over localhost.
# It is also used by Zuul merger daemons.
- $zuul_merger_hosts =
join($::network::constants::contint_zuul_merger_hosts[$::realm], ' ')
- ferm::rule { 'gearman_from_zuul_mergers':
- rule => "proto tcp dport 4730 { saddr (127.0.0.1 ::1
${zuul_merger_hosts}) ACCEPT; }"
+ $zuul_merger_hosts = hiera('contint::zuul_merger_hosts')
+ $zuul_merger_hosts_ferm = join($zuul_merger_hosts, ' ')
+ ferm::service { 'gearman_from_zuul_mergers':
+ proto => 'tcp',
+ port => '4730',
+ srange => "(${zuul_merger_hosts_ferm})",
}
# Nodepool related
--
To view, visit https://gerrit.wikimedia.org/r/201882
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I5b88b7bc33c9f1f57ac42a2e07ff51e404b0caad
Gerrit-PatchSet: 16
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Dzahn <[email protected]>
Gerrit-Reviewer: Alexandros Kosiaris <[email protected]>
Gerrit-Reviewer: Dzahn <[email protected]>
Gerrit-Reviewer: Filippo Giunchedi <[email protected]>
Gerrit-Reviewer: Giuseppe Lavagetto <[email protected]>
Gerrit-Reviewer: Hashar <[email protected]>
Gerrit-Reviewer: Muehlenhoff <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
